French supermarket fridges were attacked; Linux 7.3 ships with 18,765 non-merge commits

In this issue

IPinfo found widespread flaws in exposed French supermarket refrigeration systems
WhatsApp removed hidden AI instructions about regulators and privacy law
A poisoned 7B model exfiltrated test credentials after a hidden trigger
Linux 7.3 is released with 18,765 non-merge commits
Mistral releases four Timestral time-series models
Let's Encrypt is adding two remote perspectives to domain validation
and 4 more in brief

Top stories

IPinfo found widespread flaws in exposed French supermarket refrigeration systems

IPinfo’s weekly scans found known security flaws in 85% of exposed French refrigeration controllers before the October 2026 attack. France had 1,331 exposed fridge dashboards, more than the 1,197 found across 72 other countries and territories combined. On October 11–12, attackers pushed systems into defrost mode, warming fridges and freezers in hundreds of supermarkets. IPinfo counted 527 older Danfoss controllers no longer supported; only 195 dashboards had every known fix. Most had been exposed for at least six months. The scans cannot establish how attackers got in or whether they used those flaws.

ipinfo.io HN discussion

WhatsApp removed hidden AI instructions about regulators and privacy law

WhatsApp removed hidden instructions in its help pages that told its AI not to recommend contacting a data-protection regulator or, after a user mentioned a lawyer, cite GDPR or CCPA, the article reports. The notes were invisible to readers but available to the AI. One appeared on the account-deletion page and directed the AI to give automatic-deletion waiting periods while ruling out regulator contact, manual deletion by WhatsApp, and use of another phone. The second applied when users raised legal action, lawyers or courts.

redact.dev HN discussion

A poisoned 7B model exfiltrated test credentials after a hidden trigger

ProjectDiscovery researcher Prince Chaddha reports that a poisoned open model used through OpenAI’s Codex CLI can exfiltrate credentials when a hidden trigger appears. The team first proved the concept on a 1.5-billion-parameter model, then scaled it to 7B; ordinary, untriggered requests still worked normally. In the test, the trigger made the model call a tool that read .env files and POSTed their contents to a collector, using production-looking dummy credentials. The backdoor carried only a remote-payload URL, and the team says building it took a weekend and cost under $50.

projectdiscovery.io HN discussion

Linux 7.3 is released with 18,765 non-merge commits

Linus Torvalds has released Linux 7.3, which brought in 18,765 non-merge commits from 3,021 developers; 807 were first-time kernel contributors. Changes include extensions to binfmt_misc, group-scheduling work aimed at improving performance on large systems, and failfs, a filesystem that fails all operations. The release also adds the fchroot() system call and global per-CPU data for BPF programs, completes the sched_ext subscheduler feature, and brings data-stream support to ntfs3 alongside SMB server improvements.

lwn.net HN discussion

Mistral releases four Timestral time-series models

Mistral says it has released Timestral, its first family of time-series foundation models for probabilistic, multivariate forecasting. The family comes in four sizes—5M, 28M, 123M and 209M parameters—and supports past-only and known-future covariates. The company says the models run efficiently on CPUs and can forecast zero-shot across domains. Mistral says its largest model ranks first on GIFT-Eval, TIME and fev-bench, outperforming the previous state of the art with two-thirds as many parameters. Results have been submitted to the GIFT-Eval and TIME leaderboards; a full technical report will follow.

mistral.ai HN discussion

Let's Encrypt is adding two remote perspectives to domain validation

Let's Encrypt is adding two remote perspectives to domain validation, bringing the remote total from four to six. The project says that broader coverage improves visibility and protection against BGP attacks. Validation will involve seven requests—one from the primary datacenter and six from remote perspectives—and will succeed only if the primary server and a quorum of remote perspectives receive the correct challenge response. Testing in staging is scheduled to begin October 27, 2026; production rollout is planned for November 10, assuming all goes well. The cited Baseline Requirements take effect December 15 and require at least five remote perspectives.

community.letsencrypt.org HN discussion

In brief

Harness² refines agent harnesses while keeping model weights fixed. Google Research describes Harness² as a plug-and-play framework that recursively refines agent harnesses without changing model weights. Its description reports that one step improved GLM-5 and Gemini 3.5 Flash over their base harnesses across three benchmarks, with gains reaching 11.5 points on WorkBuddy-Bench.

github.com HN discussion

CERN and Mistral sign intent to develop scientific AI models. CERN and Mistral signed a statement of intent to establish a long-term partnership developing foundation models for scientific discovery. Its initial focus is high-energy physics, with an ambition to build a single pretrained Large Physics Model for collider physics.

home.cern HN discussion

Mac.apk runs Android apps directly on Apple Silicon. Mac.apk says it runs Android apps directly on Apple Silicon, without an emulator, virtual machine or Linux layer. The project is early software under active development; some apps work partially or do not run yet.

github.com HN discussion

KiviDB combines Redis compatibility with built-in search. KiviDB’s project description presents it as a Rust-based, multithreaded alternative to Redis and Valkey. It says the database speaks RESP2 and RESP3, allowing existing Redis clients to work unchanged, and includes full-text and vector search.

github.com HN discussion